mirror of
https://github.com/postgres/postgres.git
synced 2026-02-14 00:03:18 -05:00
33f5bf9700
This was not especially critical before, but it is now that we track ownership dependencies --- the dependency for the rowtype *must* shift to the new owner. Spotted by Bernd Helmle. Also fix a problem introduced by recent change to allow non-superusers to do ALTER OWNER in some cases: if the table had a toast table, ALTER OWNER failed *even for superusers*, because the test being applied would conclude that the new would-be owner had no create rights on pg_toast. A side-effect of the fix is to disallow changing the ownership of indexes or toast tables separately from their parent table, which seems a good idea on the whole.
44 lines
1.3 KiB
SQL
44 lines
1.3 KiB
SQL
--
|
|
-- DEPENDENCIES
|
|
--
|
|
|
|
CREATE USER regression_user;
|
|
CREATE USER regression_user2;
|
|
CREATE USER regression_user3;
|
|
CREATE GROUP regression_group;
|
|
|
|
CREATE TABLE deptest (f1 serial primary key, f2 text);
|
|
|
|
GRANT SELECT ON TABLE deptest TO GROUP regression_group;
|
|
GRANT ALL ON TABLE deptest TO regression_user, regression_user2;
|
|
|
|
-- can't drop neither because they have privileges somewhere
|
|
DROP USER regression_user;
|
|
DROP GROUP regression_group;
|
|
|
|
-- if we revoke the privileges we can drop the group
|
|
REVOKE SELECT ON deptest FROM GROUP regression_group;
|
|
DROP GROUP regression_group;
|
|
|
|
-- can't drop the user if we revoke the privileges partially
|
|
REVOKE SELECT, INSERT, UPDATE, DELETE, RULE, REFERENCES ON deptest FROM regression_user;
|
|
DROP USER regression_user;
|
|
|
|
-- now we are OK to drop him
|
|
REVOKE TRIGGER ON deptest FROM regression_user;
|
|
DROP USER regression_user;
|
|
|
|
-- we are OK too if we drop the privileges all at once
|
|
REVOKE ALL ON deptest FROM regression_user2;
|
|
DROP USER regression_user2;
|
|
|
|
-- can't drop the owner of an object
|
|
-- the error message detail here would include a pg_toast_nnn name that
|
|
-- is not constant, so suppress it
|
|
\set VERBOSITY terse
|
|
ALTER TABLE deptest OWNER TO regression_user3;
|
|
DROP USER regression_user3;
|
|
|
|
-- if we drop the object, we can drop the user too
|
|
DROP TABLE deptest;
|
|
DROP USER regression_user3;
|